Her crypto work included a wide range of policy statements and guidance that clarified the agency’s position on various aspects of the industry, including mining, staking, memcoins and — most importantly — a series of definitions for classifying different types of crypto assets and which regulator would have dominion. More recently, the agency began proposing formal rules, beginning with one known as Regulation Crypto Assets, which set up a system for offering crypto assets without triggering stringent securities regulations.

The agency’s biggest splash, though, may have been its recent opening of the pathway for tokenizing securities. The effort known as the “innovation exemption” is meant to launch the tokenized securities era in a limited, five-year approach that will inform plans for eventual agency rules that make it more permanent.

“Maximizing people’s freedom to choose what is best for themselves and their families within sensible regulatory parameters designed to give them the confidence to transact with others is a delicate and vitally important task for the regulator,” Peirce, who’s going to be an associate professor at Regent University School of Law, wrote in her resignation.

Peirce acknowledged her nickname, “Crypto Mom,” in a 2019 speech during the industry-resistant era at the agency, and she also noted the agency had “hindered innovation and growth,” saying, “The only guidance out of the SEC is a parade of enforcement actions and a set of staff guidance documents and staff no-action letters.”

Google has disclosed that its PageBreak AI security agent has found over 500 cross-site scripting vulnerabilities across the company’s web applications.

The Google Product Security team said PageBreak began as a pilot in November 2025 and became a formal project in January 2026. It tests Google’s own web applications and has found cross-site scripting, or XSS, flaws even on sensitive company domains. Google did not identify the affected applications in its announcement.

XSS occurs when an application allows an attacker’s script to run in another user’s browser. Depending on the application and the attacker’s access, the flaw can expose data or let someone act through an affected user’s session. Google reported more than 500 findings across its applications, but did not give a breakdown by product or severity.

How PageBreak confirms suspected flaws

Rather than sending every suspected bug to a product team, PageBreak passes each candidate to a specialized validator. For an XSS finding, the validator inserts a JavaScript payload, loads the affected page, and checks whether the script runs. Google said the validation step has kept the system’s false positive rate close to zero.

The agent can also test other types of flaws. According to Google, its validators check whether an injected input changes a database query, whether an application exposes a file through path traversal, or whether it can be made to execute code. A separate check looks for requests that an application sends to internal services.

Most PageBreak scans use Gemini models, including Gemini 3.1 Pro and Gemini 3.5 Flash, although Google said the agent can work with different models. The validators themselves are not written by the AI agent. Google also runs agents through repeated attempts because a model can follow an unproductive path before finding a workable exploit.

Google built the validation process in response to a problem its security staff had encountered: AI-generated reports can describe convincing attack paths that fail when tested. Under PageBreak’s process, unverified candidates stay within the security team’s workflow. They can guide later scans or help engineers build new validators, but Google said they are not sent to product teams as confirmed bugs.

PageBreak found two flaws in protected applications

Among hundreds of applications built on Google’s high-assurance web frameworks, PageBreak identified two XSS vulnerabilities as of Sep. 4, Google said. Both were confined to internal applications or debug endpoints with gaps in their security protections. The result covers that group of applications; Google’s figure of over 500 findings covers its first-party web applications more generally.

The framework result gives Google a way to test how its application design holds up against repeated scans. PageBreak also has access to company tools that help it inspect applications at scale. Google said its code repository lets the agent follow paths across services, while security data from live web traffic can connect a requested page to the relevant source code. Existing scanners give it authenticated access to internal sites that can be difficult for an outside researcher to examine.

Those resources help explain the scope of Google’s findings without suggesting that another organization could obtain the same results simply by running a Gemini model. PageBreak’s reported count comes from scans of Google’s applications with access to Google’s code, traffic data and testing systems.

Crypto teams face the same verification workload

The problem of checking AI-generated security reports has also surfaced in crypto software. In July, Ethereum Foundation security research described a process in which agents develop potential findings and separate reviewers try to reproduce them. The foundation reported one confirmed flaw in libp2p, later disclosed as CVE-2026-34219, while warning that plausible reports can involve unreachable code or attack conditions that do not hold in practice.

For teams that handle crypto users’ funds, the difference between a candidate issue and a working exploit affects how quickly a report can lead to a fix. An August Bitcoin Red Team scan logged 7,958 findings across 501 open-source projects after 108 hours. At that point, 24.7% of the findings had reproducible proofs; the full tally did not represent 7,958 confirmed exploitable vulnerabilities.

Earlier reporting on crypto bug bounties described a similar review burden. Cosmos Labs co-CEO Barry Plunkett said in April that submissions to its program had risen 900% from the previous year, including both valid and invalid reports. PageBreak is an internal Google tool, and Google has not said it is available to crypto projects.

Google plans to pair findings with fixes

Even after limiting reports to verified findings, Google said its product teams still receive a high volume of security work. PageBreak is therefore working with other Google projects, including CodeMender, an agent that generates bug fixes. Google plans to deepen that connection so product teams can review proposed fixes alongside confirmed vulnerabilities.

OG.com Markets is seeking US regulatory approval to offer perpetual futures tied to individual stocks, as trading platforms push to bring the popular derivatives product to US equity markets.

In a Thursday filing with the Commodity Futures Trading Commission (CFTC), OG.com proposed new rules allowing it to list cash-settled single-stock futures that never expire and can trade 24 hours a day, five days a week.

OG.com was recently spun out of crypto exchange Crypto.com as an independent prediction markets and derivatives platform valued at $5 billion. At the time, CEO Kris Marszalek said the platform planned to expand beyond prediction markets into futures and perpetual contracts.

Shortly after the spin-off, Robinhood took an equity stake in OG.com as part of a multi-year deal to use its CFTC-regulated derivatives exchange and clearinghouse for prediction markets.

Unlike traditional futures contracts, perpetual futures, or “perps,” have no expiration date, allowing traders to maintain exposure without periodically rolling into new contracts. The product was pioneered in crypto by BitMEX in 2016.

Related: President Trump’s media company to terminate Crypto.com deal

Perpetual futures push expands into US stocks

Crypto trading platforms and prediction markets are increasingly looking to bring one of the digital asset market’s most popular derivatives products to US stocks, with OG.com joining a growing group seeking regulatory approval.

On Sept. 18, Coinbase, Kraken parent Payward through its Bitnomial exchange, and prediction market Kalshi all filed to offer perpetual futures tied to individual US stocks.

The filings came after US regulators, including the Securities and Exchange Commission (SEC) and CFTC, pushed ahead with crypto initiatives despite the CLARITY Act failing to advance in the Senate on Sept. 15.

Source: Paul Atkins

Just days after the vote, the SEC cleared limited onchain trading of tokenized US stocks under its Innovation Exemption, while the CFTC expanded regulatory relief for software providers connecting users to regulated derivatives platforms, including those offering perpetual contracts.

The CFTC had already begun laying the regulatory groundwork for perpetual futures months earlier.

In May, the agency established a case-by-case review process for perpetual contracts and approved Kalshi’s Bitcoin perpetual futures product, followed in June by temporary relief allowing certain registered exchanges to convert existing crypto futures into contracts without expiration dates.

Magazine: Exchanges reporting crypto gains to IRS becomes tax nightmare

The 6th U.S. Circuit Court of Appeals ruled on Friday that states have a right to regulate sports-related event contracts on prediction market platforms, marking a second major legal defeat for the industry as a fight at the U.S. Supreme Court looms. 

In a unanimous decision, the three judge panel said that Ohio and Tennessee are permitted to apply their state gambling laws to Kalshi’s sports-related event contracts. 

“We hold that Kalshi has not shown that its sports-event contracts satisfy the statutory definition of a ‘swap’ so as to fall within the scope of the CFTC’s ‘exclusive jurisdiction,’” the opinion said. 

Kalshi and other prediction market platforms argue all event contracts are swaps, a type of financial derivative that is regulated by the Commodity Futures Trading Commission. However, states assert that platforms’ sports-related offerings amount to gambling, and thus should be regulated by their laws related to sports betting. 

This disagreement has spawned a legal battle across the country as states sue platforms for operating what they often claim are illegal gambling operations, while exchanges also sue states to block them from enforcing local laws on what they argue should be federally-regulated financial exchanges. 

The CFTC has sued nine states to defend what it believes is its exclusive right to regulate event contracts, given to it by the Commodity Exchange Act. But the 6th Circuit panel rejected that notion. 

“Even assuming that Kalshi’s sports-event contracts are swaps, we alternatively hold that the CEA neither expressly nor impliedly preempts Ohio’s or Tennessee’s gambling laws,” the opinion said. The decision overturns a Tennessee federal district court ruling that sided with Kalshi, and reaffirms a decision by a federal district court in Ohio that sided with the states’ argument. 

“Kalshi attempted an end run around Tennessee law to avoid any of the rules or taxes associated with sports gambling. They failed,” said Jonathan Skrmetti, Tennessee’s attorney general.

“Sports wagering is heavily regulated because it can do a lot of harm, and I’m glad we thwarted Kalshi’s efforts to remove every safeguard and put Tennessee sports bettors at risk,” he added.

Kalshi nor the CFTC immediately responded to requests for comment. CNBC has also reached out to the Ohio attorney general’s office for comments. 

The latest ruling now means prediction market platforms have notched two losses in legal fights at the appeals court level. The 9th U.S. Circuit Court of Appeals ruled last month that Nevada has a right to regulate sports-related event contracts, stating that they were sports bets and not swaps. Meanwhile, the 3rd U.S. Circuit Court of Appeals ruled against New Jersey in April and said the CFTC has the exclusive right to regulate all swaps, no matter the contract type. 

New Jersey appealed that decision in a petition to the Supreme Court earlier this month. It is not clear whether the Supreme Court will take up the case now, or wait until further decisions from circuit courts on the issue of sports-related event contracts are delivered. 

Disclosure: CNBC and Kalshi have a commercial relationship that includes customer acquisition and a minority investment.

How accurate is the Netflix movie?

When Haru meets Fedir—whose wife is a Paris-based dance champion, though the marriage is an open one—she glimpses fresh possibilities, or at least just an adventure. In an early scene, after she and Fedir have had a pleasant, platonic dinner together, they’re ready to part ways in the street. A crew of drunken businessmen jostle Haru, and Fedir stands up for her. What follows is a cleverly choreographed dream ballet—though the genre is actually the bachata, one of the dance forms Fedir teaches, its movements an expression of longing and heartache—in which Fedir defends Haru’s honor against this gang of boorish men. Other passersby join in, and the scene becomes a metaphor for the act of rejoining life. By the end of the evening, Haru and Fedir have tumbled into bed.

Their two hookups are enjoyable and tender—until the wife shows up, and Haru realizes she has feelings she can’t control. Kikuchi shifts gears smoothly: One minute, she shows how Haru is nearly deadened by sorrow. The next, her exhilaration becomes a kind of artificial sunshine. But a flash of anger and jealousy causes her to act out, in a scene that makes you recoil a bit even as you laugh. Kikuchi is perhaps best known for her roles in movies like Babel and Pacific Rim, as well as HBO’s Tokyo Vice, several episodes of which Wladyka directed. Here, she captures the spirit of a woman who longs to get back to being herself, if only she could remember who that self was. Haru is both breezy and cautious, and totally lost. By the movie’s end, she has found her way forward, because she realizes there’s no going back. She’ll have to be a new person, encompassing the experiences and memories of the old one. Kikuchi captures that difficult butterfly transition as it unfolds; it’s both painful and funny to watch. But in the end, she shows us how Haru finds her way back to the music, which is the only way she can move into the future, one note, and one dance step, at a time.   

Summer Mersinger is leaving the helm of the Blockchain Association, one of the crypto industry’s leading advocacy groups, a week after the sector weathered a major legislative setback in the loss of the Digital Asset Market Clarity Act.

Mersinger will be replaced — for now — by Kristin Smith, the organization’s original CEO who ran the association from its launch in 2018 until 15 months ago, according to a Friday statement. The handover is set for October 16, closing a tumultuous era that saw major crypto wins in Washington and a significant defeat last week, when the U.S. Senate failed to advance the Clarity Act in a wide loss in which all the Senate’s Democrats and some Republicans declined to support it.

“I’m proud of how far we’ve come together, from the GENIUS Act to real regulatory clarity at the SEC and CFTC,” said Mersinger, who’d taken the job after leaving her post as a member of the Commodity Futures Trading Commission, in a statement. “Kristin built this association from the ground up, and BA is in good hands. I’ll be cheering them on.”

Hsin-Ju Chuang, a former partner at the crypto venture firm Hack VC, has died at age 37, according to the San Bernardino County Sheriff-Coroner. The county’s Coroner Death Registry later listed her death as a suicide.

California Highway Patrol officers responded on Aug. 24 to a report southbound on Interstate 15 south of Field Road in Harvard, California, where Chuang was pronounced dead at the scene, the sheriff’s office said in a coroner press release linked in the report.

Key takeaways

• San Bernardino County Sheriff-Coroner records list Chuang’s death as a suicide after an Aug. 24 response on Interstate 15.
• Chuang previously worked across major crypto ecosystems, including roles tied to Stellar and Solana.
• Hack VC said it had not spoken directly with Chuang for more than 10 months and had no additional details about the circumstances.
• Chuang had publicly accused Hack VC of mistreatment and said she planned to release evidence, according to her earlier posts.

What authorities and county records show

Officer response details point to an Aug. 24 incident on Interstate 15 in Harvard, California. Chuang was pronounced dead at the scene, according to the information referenced from the San Bernardino County Sheriff’s media materials.

A search of the San Bernardino County Sheriff’s Department Coroner Death Register shows Chuang’s entry dated Aug. 24, 2026. The registry later categorized her death as suicide.

Chuang’s background in crypto investing and projects

Chuang’s professional profile traces a career spanning both venture and ecosystem growth. Per her LinkedIn profile, she founded Dystopia Labs and held leadership roles that included head of growth at Stellar and Solana.

In venture, she joined Hack VC in 2021 as a venture partner. Later, she became partner and head of platform in 2025, according to the same publicly listed career history.

Hack VC’s statement and what it said it knew

Hack VC co-founder and managing partner Alexander Pack said the firm was “shocked and saddened” by Chuang’s death and extended condolences to her family, friends, and those close to her.

Pack added that Hack VC had not spoken directly with Chuang for more than 10 months. He said the firm was not aware of the circumstances surrounding her death and that it had “no further information,” urging people to be respectful of those grieving.

Earlier public accusations and unresolved questions

Before her death, Chuang had publicly accused Hack VC of mistreating her during her time at the firm. In her posts, she said she intended to release evidence supporting her allegations.

In that context, Chuang also described attempting suicide after experiencing what she characterized as mistreatment while she was “going through a serious medical emergency,” according to the account presented in the earlier public statement referenced in the report.

With the coroner registry now listing her death as suicide, the relationship between those prior allegations and the circumstances of her death remains a sensitive and unconfirmed area that readers should approach cautiously. Hack VC’s statement emphasizes it did not have recent direct contact and did not know the circumstances at the time of her passing.

Chuang’s death also raises a broader question for the crypto industry: how mental-health and workplace conflict are handled, documented, and addressed—especially in highly networked environments where reputational battles can move quickly into public channels.

For now, what matters most is what additional public information, if any, emerges from the coroner process and whether any further verified details about the earlier claims become available. Observers will likely watch for follow-up statements from those close to Chuang, as well as any developments that clarify the gap between her earlier allegations and the circumstances surrounding her death.